There is no overarching statutory law or regulatory law specifically governing AI in Hong Kong.
As AI often involves the use of data sets containing personal data of individuals during problem solving and training, the Privacy (Data) Protection Ordinance (PDPO) applies to AI. The PDPO stipulates six data protection principles, which broadly govern the collection, use, protection and treatment of personal data. Anyone creating and operating AI handling personal data must comply with these principles at all times.
The Office of the Privacy Commissioner for Personal Data (PCPD) has also issued its Guidance on the Ethical Development and Use of Artificial Intelligence, which specifically applies to the use of AI when personal data is used to train, or be analysed by, AI systems.
Apart from the PDPO, the existing legislation of Hong Kong and common law also apply to certain aspects of the use of AI in Hong Kong – for example, the IP rights in the AI system.
As far as the statutory law is concerned, the position is that the PDPO applies and regulates the use of personal data by AI.
As for common law, as a matter of principle, the Hong Kong courts will interpret legislation or common law principles liberally to address a novel scenario with reference to, for example, the legislative intent so as to avoid reaching an unreasonable conclusion. This principle also applies if a case involving AI is heard by the courts where the issue in question is not specifically governed by any legislation.
There have been no reported cases in Hong Kong in which AI has become the subject of contention.
Yes, any user of AI is expected to exercise a duty to take reasonable care when using AI. Hong Kong courts adopt the principle in the English landmark case of Donoghue v Stevenson that the categories of negligence are not limited. As such, the Hong Kong court will find a user of AI to be in breach of duty of care if the following elements can be satisfied:
Yes, the general law is applicable by analogy in Hong Kong. Robots and mobile AI may cause nuisance or damage due to faulty design, or because the AI goes rogue and escapes from control.
(a) Faulty design
Our answer to question 1.3 on the law of negligence applies to robots or AI causing nuisance or damage due to faulty design.
(b) Robot goes rogue and escapes
The law of nuisance, as well as the doctrine in Ryland v Fletcher (ie, if a person keeps something that would likely cause mischief on their property, such person will be liable for any natural consequence flowing from that object's escape), apply to the situation where AI goes rogue and escapes control.
In Hong Kong, it is established law that nuisance applies to trivial matters such as cold air from air conditioning and water leakage. If a robot goes rogue, intrudes and causes nuisance on the neighbour's property or otherwise hampers the enjoyment of such property, as long as all of the requisite elements of nuisance can be proved to the satisfaction of the court, there is no reason why the court will not hold the user of AI liable for nuisance.
There are no special regimes in Hong Kong, except that the PCPD's Guidance on the Ethical Development and Use of Artificial Intelligence specifically applies to the collection and use of personal data by AI. Please see question 1.1.
Hong Kong is a co-sponsor of the Declaration on Ethics and Data Protection in AI dated 23 October 2018. The declaration enshrines several general principles relating to the use and development of AI, including the following:
Hong Kong is also a sponsor of the Resolution on Accountability in the Development and Use of AI, which was adopted in October 2020. The resolution sets out more specific principles regarding the development and use of AI.
While these instruments are not legally binding or enforceable, the principles they espouse show where the Hong Kong government stands and provide guidance on the use and development of AI in Hong Kong. The principles mentioned in the above instruments have been incorporated into the Guidance on the Ethical Development and Use of Artificial Intelligence.
There is currently no authority designated to monitor the use and development of AI in Hong Kong.
As far as the collection and use of personal data in the course of training or operating AI is concerned, the PCPD is the authority responsible for enforcing privacy law in Hong Kong. The PCPD is empowered by the PDPO to, among other things:
There are no overarching legislation or regulations in Hong Kong governing AI, although the PDPO and the Guidance on the Ethical Development and Use of Artificial Intelligence regulate the use of personal data by AI. AI is mainly regulated by the existing legislation (to the extent legally permissible) and by certain non-binding guidelines, including:
In Hong Kong, data analysis and process automation are perhaps the most commonly used AI applications.
AI is capable of processing huge amounts of data quickly. In the banking industry, for example, AI is used to identify suspicious transactions within the context of anti-money laundering assessments and to give financial advice to clients after analysing historical market data.
AI is also used to handle repetitive procedures. AI-powered chatbots help to handle queries from customers and provide recommendations in e-commerce and the banking industry.
In Hong Kong, AI-powered products and services are mainly used by businesses in the banking and e-commerce sectors.
(a) Banking
Banks offer a range of services powered by AI. AI is incorporated into algorithms to conduct trading and provide financial advice to clients. AI is also used to automate repetitive operational processes, such as preparing and reviewing trade finance documentation, by using its deep-learning based techniques to instantly extract relevant information from trade documents. AI-powered chatbots are also widely used by banks to answer customer queries.
(b) E-commerce
In e-commerce, AI is used to power product recommendation tools, as well as chatbots to screen, triage or even handle consumer queries.
Most AI companies are private companies limited by shares. The companies developing AI products and AI-powered services are commonly private start-ups. There are, however, exceptions, such as SenseTime (focused on computer vision and deep learning), which is a Cayman company headquartered and listed in Hong Kong.
As with private start-ups, most AI companies in Hong Kong are funded by seed capital or venture capital. As their businesses mature, some start-ups may eventually go public, as in the case of SenseTime, which listed on the Hong Kong Stock Exchange in December 2021 (see question 2.3).
Funding support is also available from various government funds in Hong Kong. The Innovation and Technology Fund (ITF), for example, grants monetary support for different AI projects. In 2017, the Hong Kong government set up a HK$2 billion Innovation and Technology Venture Fund to co-invest in local start-ups with other private venture capital funds on a matching basis.
There are also private funds in the market which finance AI companies. In May 2018, Alibaba, SenseTime and the Hong Kong Science and Technology Parks Corporation launched the HKAI Lab, an accelerator programme that allows interested and qualified AI companies to apply for funding after they pass an evaluation by Alibaba and/or SenseTime.
The Hong Kong government is supportive of the development of AI in Hong Kong, with a view to promoting Hong Kong as an Asian tech hub.
In terms of providing financial support, the Hong Kong government helps AI companies and projects in the following manner:
Apart from providing financial support, the Hong Kong government has also committed to nurturing talent in the R&D field – for example, by creating scholarships and internship initiatives.
Existing infrastructure, such as the Science Park and Cyberport, also provide a friendly environment for AI companies to connect with other businesses and service providers.
(a) Healthcare
Businesses in the healthcare industry are increasingly reliant on AI to help manage data, in particular patients' data. In Hong Kong, the Electronic Health Record Sharing System (eHRSS) stores and shares patients' medical records among private and public healthcare providers. In addition to the Privacy (Data) Protection Ordinance (PDPO), the eHRSS Ordinance was promulgated to:
Telemedicine is also growing in Hong Kong. Certain aspects of telemedicine feature the use of AI – for example, reviewing imaging scans. The Medical Council of Hong Kong has issued the Ethical Guidelines on Practice of Telemedicine, which state that only medical professionals registered in Hong Kong under the Medical Registration Ordinance can provide medical advice, which effectively prohibits the provision of medical advice generated by AI without supervision by qualified medical practitioners.
(b) Security and defence
AI has been used by law enforcement in Hong Kong for a number of years. For example, the Hong Kong police use different AI systems (eg, facial recognition) to help with law enforcement – such as by monitoring illegal parking through licence plate recognition.
The major concern arising from the use of AI by law enforcement is the mass mining of personal data – in particular, facial images and other biometric data. The Hong Kong government declared that data subjects should be granted the right to opt out of any decision made against them based solely on information processed by AI, including 'profiling', which is targeted at the detection of certain traits or characteristics.
Use of AI by law enforcement should also comply with the existing laws and regulations on law enforcement. For example, the Interception of Communications and Surveillance Ordinance requires law enforcement agencies to strike a balance between the right to privacy and law enforcement needs in interceptions or covert surveillance. Any use of AI for either of these must comply with the requirements set out in the Interception of Communications and Surveillance Ordinance.
(c) Autonomous vehicles
Autonomous vehicles are still at an early stage in Hong Kong and are not seen on the roads. Generally, vehicles not compliant with the technical standards in terms of design, construction and operation for vehicle registration and licensing requirements under the current regulatory framework cannot be driven on the road. Autonomous vehicles are currently legally not roadworthy, partly due to the risks posed by the use of unapproved auto-lane changing and auto-steering technology used by autonomous vehicles.
That said, the Transport Department has issued movement permits under the Road Traffic Ordinance and also issued the Guidance Note on the Trials of Autonomous Vehicles in 2020 to enable trials of autonomous vehicles in Hong Kong. It remains to be seen how the regulatory regime will keep up with autonomous vehicles in the future – particularly regarding:
(d) Manufacturing
There is no specific legislation in Hong Kong that addresses manufacturing using AI. While goods sold in Hong Kong are generally governed by the Sale of Goods Ordinance and the Consumer Goods Safety Ordinance, depending on the type and nature of the goods in question, other legislation may also be applicable. For example, the Toys and Children's Products Safety Ordinance specifically regulates the safety of toys and goods for children.
Manufacturers in Hong Kong are also bound by the Factories and Industrial Undertaking Ordinance, which governs the health and safety of personnel in an industrial setting. The obligations imposed on manufacturers include, among others:
These obligations also apply to those using AI in the manufacturing processes, which means they need to provide proper training and instruction to staff on issues such as:
Manufacturers must also monitor AI-powered manufacturing processes and inspect the end product to ensure they meet statutory standards.
(e) Agriculture
Agriculture on a commercial scale is basically non-existent in Hong Kong. There is no regulatory intervention from the Hong Kong government into the use of AI in agriculture in Hong Kong.
That said, the Hong Kong government is currently building an agricultural park covering over 7.5 hectares of land. It remains to be seen whether and how the potentials of agritech (a term coined for 'agricultural technology') will be explored after the completion of the agricultural park.
(f) Professional services
The banking and financial industries are the biggest users of AI in Hong Kong. AI is widely used in their daily operations and delivery of services to clients. AI is also applied in their risk management procedures, such as detecting anti-money laundering activities and due diligence on fund transfers.
The city's de facto central bank, the Hong Kong Monetary Authority (HKMA), has issued circulars to provide guidance on the use of AI in the banking and financial industries. The HKMA has warned that over-reliance on AI may compromise proper validation expected from financial institutions. Financial institutions are reminded to ensure that their obligation to properly assess the financial capabilities of clients is not compromised by the use of AI; nor does the use of AI mitigate the financial institutions' liabilities from the consequences of any conduct.
(g) Public sector
As set out in questions 10.2 and 12.1, the Hong Kong government is pushing to incorporate technology (AI being a prominent part) into public services according to the Smart City Blueprint for Hong Kong 2.0 initiative. One of the key highlights is to streamline government services by developing a hub that allows citizens to submit and process their building plans and apply for licences online under the Be the Smart Regulator Programme and the Streamlining of Government Services Programme respectively.
During the COVID-19 pandemic, the Hong Kong government launched the StayHomeSafe and LeaveHomeSafe mobile apps, to ensure that members of the public complied with pandemic measures and laws by using big data analytics and AI technology. Members of the public raised concerns about the mass mining of personal data; but the Office of the Privacy Commissioner for Personal Data gave assurances that a balance had been struck between privacy rights of patients and public health, and that these applications were in compliance with the PDPO.
The data protection regime in Hong Kong is the Privacy (Data) Protection Ordinance (PDPO).
The PDPO is highly relevant to AI companies in general. The Office of the Privacy Commissioner for Personal Data (PCPD) has made it clear that the PDPO applies to the collection and use of personal data by AI. Please see questions 1.1 and 1.7 for further details.
There is no separate cybersecurity regime promulgated in Hong Kong. The issue of cybersecurity is currently very much addressed in the context of personal data protection in accordance with the PDPO and the Guidance on the Ethical Development and Use of Artificial Intelligence.
What is particularly relevant to AI companies and applications is Data Protection Principle 4 stated in the PDPO, under which all data users must ensure that collected personal data is protected against unauthorised or accidental access or processing. This obligation applies even if an entity transfers personal data to a data processor for processing.
The Hong Kong government announced that a consultation on new cybersecurity legislation will be held at the end of 2022. The Hong Kong Computer Emergency Response Team Coordination Centre has warned that the growing popularity of AI will make cyberattacks more sophisticated and more difficult to handle in the future. The introduction of new cybersecurity legislation in the near future in Hong Kong reflects the government's commitment to taking a more proactive role in regulating the AI industry. It remains to be seen what the AI companies and applications will be required to do following the introduction of the new cybersecurity law.
The Consumer Council of Hong Kong observed that small and medium-sized enterprises (SMEs) are likely disadvantaged by their limited access to data in comparison with big corporations. A study by the Consumer Council also discovered that the sheer volume of personal data collected by large tech companies means they tend to have more effective and accurate AI systems, which consolidates the edge that these large tech companies have over the SMEs in the market.
The Consumer Council suggested that the Hong Kong government should introduce policies to ensure that:
These suggestions have been followed up by the Business Facilitation Advisory Committee, which advises the Hong Kong government on business policies.
From an employment perspective, AI impacts the local workforce in the following ways.
AI's impact on the workforce: As with other economies, AI competes with human labour and makes some jobs obsolete. Research shows that around 1 million people in the Hong Kong workforce may face up to a 70% risk of being replaced by AI. Positions such as clerks and cashiers are among the jobs most vulnerable to replacement by AI.
One way to cope with the challenge posed by AI is to equip the workforce – especially the next generation – with the skills needed to make good use of AI. School curricula at the pre-secondary and secondary level now focus on building a solid foundation among students. At the post-secondary level, there are university courses and placement programmes that train university students to use AI.
AI in recruitment: More recruiters in Hong Kong use AI to help in the recruitment process, which may become increasingly susceptible to AI-induced biases and discrimination. There are reports that AI-recruitment tools have discriminated against female candidates, as the historical data learned by the system mostly comes from men's CVs.
AI systems can be trained to be more gender neutral. Recruiters should also screen the results generated by AI and use their experience to adjust the recruitment decisions recommended by AI.
Employees' data: AI analyses personal data from job candidates in the recruitment processes as well as from employees. The Office of the Privacy Commissioner for Personal Data notes in the Guidance on the Ethical Development and Use of Artificial Intelligence that the use of AI in job recruitment poses a high risk to data subjects from a data protection perspective and stresses that human oversight is necessary.
Data manipulation will likely impact on consumer rights and system security.
Consumer rights: The Consumer Council of Hong Kong is dissatisfied with the fact that businesses seldom inform consumers that recommendations are powered by AI and consumers are also not offered the option to switch off these AI-generated recommendations.
Security loopholes: According to the Hong Kong Computer Emergency Response Team, AI-powered tools are susceptible to membership inference attacks. Hackers may create an AI system similar to that operated by a business and then feed their own manufactured AI data similar to the private data used by the business. With sufficient training, it is possible the hacker's system can map out all the data utilised by the business's own AI system, thereby gaining access to private data.
AI is also prone to attacks by hackers – for example, injecting misleading data into AI so as to influence its behaviour.
There is no AI 'best practice' as such in Hong Kong; but the Guidance on the Ethical Development and Use of Artificial Intelligence issued by the Office of the Privacy Commissioner for Personal Data (PCPD) does list the values and principles that it recommends AI companies adhere to, as follows:
The PCPD expands on the seven principles listed in question 8.1 as follows:
Data users should designate sufficient manpower with expertise in different areas (eg, computer science, legal and public relations) to constantly monitor and review internal AI governance, policy and procedures. Adequate training should also be provided to staff on the ethics and values to which the data user is committed. Reviewing AI policy based on the Self-assessment Checklist at Appendix A of the Guidance on the Ethical Development and Use of Artificial Intelligence issued by the PCPD would be a good starting point.
AI brings about both benefits and challenges. One of the concerns is that if a party chooses to perform its contractual obligations using AI, the results can be unanticipated.
The benefits of AI are obvious. For example, computers work around the clock and can digest a large amount of information quickly. Given that computers are not prone to human errors, their productivity is considered consistent and reliable.
On the flipside, results generated by AI can be unfair or faulty. A glitch at the input stage may cause grave consequences. AI is also prone to hacking, so there is a cybersecurity issue. If the system goes down, the downtime can be extensive.
Contracting parties are recommended to take these potential risks into account and try to address these contingencies in the contract as far as possible, especially if it is anticipated that AI will likely be used by any party to perform its contractual obligations. The risks posed by the use of AI can hardly be eliminated; but better and more precise contractual language would help to mitigate, to a certain extent, the uncertainties and risks that may arise from the use of AI in the performance of a contract.
Using AI does not exempt the company concerned from being liable for damage to property or personal injury caused by the AI. Contractually, if a party fails to perform in accordance with the contract due to mistakes and errors caused by an AI malfunction or breakdown, that party is still in breach of the contract.
One way to mitigate the risks is to take out insurance with sufficient coverage for liabilities arising from the use of AI. As explained in question 9.1, it may also be possible to address the risks by including language that specifically addresses the use of AI and its potential consequences in the contract.
As a tool to filter, sort, classify and aggregate data, AI relies heavily on input. It cannot tell whether the data pool is unbalanced and whether criteria set by a software engineer are biased or discriminatory.
To mitigate these risks, human supervision should come into play to review the results generated by AI and check their validity and reliability against data input.
AI innovation is protected in Hong Kong by the following instruments:
The Hong Kong government is committed to promoting the city as a hub of innovation and technology. There are a number of programmes in place to utilise the advantages and resources brought about by mainland China's technological developments with the aims of:
These initiatives and measures include:
The employment regime in Hong Kong is relatively straightforward. The parties are free to negotiate the terms of the contract subject to the law. The relevant laws that govern employment in Hong Kong include:
It is not uncommon for jobseekers or employees to provide personal data to employers and AI may play a role in collecting such personal information. The Privacy (Data) Protection Ordinance governs the use of personal data and regulates the relationship between data subjects (jobseekers and employees) and data users (employers). The Office of the Privacy Commissioner for Personal Data has published the Code of Practice on Human Resource Management: Compliance Guide for Employers and Human Resource Management Practitioners to help employers comply with the law.
For example, during the recruitment process, the employer should specify the purpose of collecting an applicant's personal data (ie, for recruitment purposes only). The data collected should not be excessive and should be relevant to identifying and assessing candidates on their suitability for the position. During employment, the employer should grant employees the rights to access and correct their personal data. Information regarding the employee's disciplinary proceedings, performance appraisal and promotion:
Specialist talent can come to work in Hong Kong by applying for a visa under the General Employment Policy (GEP). The GEP requires applicants to have already secured employment in Hong Kong before application. The GEP also offers an entrepreneur track that allows any individual who plans to establish or join a business in Hong Kong to make an application.
Another avenue is an application for a visa under the Quality Migrant Admission Scheme (QMAS). Applicants under the QMAS are not required to have already secured employment in Hong Kong; but only applicants with particular skills or talents or with outstanding achievements (eg, winners of national or international awards) are qualified to apply. The QMAS is a point-based system, so factors including age, work experience and academic or professional qualifications are all relevant.
These two schemes are not targeted at talent in the AI industry in particular. Successful applicants will be granted a work visa based on conditions, so any change in employment status or personal information will need to be notified to the Immigration Department.
The Hong Kong government has also rolled out the Technology Talent Admission Scheme (TechTAS), a hybrid of GEP and QMAS targeting non-local talent in the research and development of certain industries, including AI. The TechTAS is a fast-track scheme, but the quota is more limited.
While AI is increasingly used by companies and organisations in Hong Kong, it is mainly used to power chatbots and marketing analytics to improve customer experience. A handful of shopping malls or commercial buildings have reportedly adopted AI for building management purposes, such as disinfecting and sanitising public areas. Autonomous vehicles are not yet roadworthy as such, but trials have been allowed. While currently, the full potential of AI has not been fully explored in Hong Kong, possible benefits brought about by the use of AI are apparent, with more businesses moving to integrate AI in daily operations to cut costs and increase efficiency. Banks are a good example of this, with AI being used to help with due diligence on account opening and detecting money laundering activities.
Currently, the laws and regulations governing AI are minimal. There is no overarching legislation regulating the use of AI. There are some regulations and guidelines; but they mainly provide guidance on the use of personal data. The Hong Kong government is committed to developing AI-related industries in the future. Therefore, it is anticipated the government and legislature will play a more active role in updating laws and regulations on the use of AI and safeguard the interests of stakeholders and the community as a whole. The general direction will hopefully become clearer after the launch of the cybersecurity legislation consultation by the end of 2022, as announced by the Innovation, Technology and Industry Bureau of Hong Kong.
At present, Hong Kong is rather light in terms of regulating AI and AI companies. Save for autonomous vehicles, which are not approved to run on the roads, the operations of AI companies are not regulated as long as they comply with the laws of Hong Kong. There is nothing that restricts established AI companies from overseas from launching businesses in Hong Kong. It is easy to incorporate a company and set up a business in Hong Kong. Tax rates for corporations are low. There is a pool of talent specialised in science and technology from local universities and current visa programmes facilitate the entry of foreign talent to work in Hong Kong. The cost of complying with the existing legal regime to launch an AI-related business in Hong Kong is relatively low compared with other jurisdictions.
That said, there are practical issues that an AI company looking to enter Hong Kong should consider, such as the high cost of living. Another issue is perhaps the unpredictability of the legal regime going forward. The Hong Kong government has yet to regulate the use of AI, but it is committed to taking a more proactive role in the near future. Hong Kong is a traditionally business-friendly market economy with minimal red tape, and this will remain the case in the foreseeable future; but it will be interesting to observe how the legal regime governing AI will evolve after the introduction of the new cybersecurity law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
© Mondaq® Ltd 1994 – 2023. All Rights Reserved.
Forgot your password?
Free, unlimited access to more than half a million articles (one-article limit removed) from the diverse perspectives of 5,000 leading law, accountancy and advisory firms
Articles tailored to your interests and optional alerts about important changes
Receive priority invitations to relevant webinars and events
You’ll only need to do it once, and readership information is just for authors and is never sold to third parties.
We need this to enable us to match you with other users from the same organisation. It is also part of the information that we share to our content providers (“Contributors”) who contribute Content for free for your use.
Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.